Overview

OX Security researchers identified malicious releases of legitimate npm packages compromised in a campaign linked to the PolinRider malware family.

The injected code uses the Ethereum blockchain as a dead drop for command-and-control (C2) infrastructure. When an affected package is imported, a hidden loader queries public Ethereum RPC endpoints to retrieve a C2 IP address encoded in a blockchain transaction. It then downloads an XOR-obfuscated JavaScript payload over HTTP and executes it.

This technique allows attackers to change the infrastructure used to deliver malicious code without modifying the compromised npm packages themselves. By updating the blockchain-based reference, attackers can redirect affected installations to new infrastructure while leaving the published package code unchanged.

The campaign uses two obfuscation techniques to conceal the loader: Base64-encoded JavaScript and a character-permutation bootstrap. Researchers also identified execution through an interactive Node.js process, allowing malicious code to run in memory and potentially complicating detection.

  1. Check for affected versions. Review installed dependencies and lockfiles for the compromised package versions listed below. Installation alone does not necessarily mean the malicious payload executed.
  2. Investigate potential wallet compromise. If an affected package was loaded and the malicious code executed, treat cryptocurrency wallets and associated credentials accessible from that environment as potentially compromised.
  3. Restrict dependency updates. Pin dependencies to verified clean versions and consider implementing a minimum package-age policy to reduce exposure to newly published malicious releases.

Impact

  • The affected packages collectively account for approximately 1,400 weekly downloads. This figure reflects package download activity, not confirmed infections or executions of the malicious payload.

Threat Analysis

We identified a multi-stage attack in which malicious code embedded in npm packages uses obfuscation, Ethereum-based command-and-control infrastructure, and in-memory execution to deliver additional payloads.

The following diagram illustrates the attack chain, from the initial malicious code in index.js to the retrieval and execution of a remote payload.

Inside the index.js file, researchers identified a hidden eval(atob(…)) function that decodes and executes a malicious Base64-encoded payload.

After decoding it, we can see the crypto stealer logic, with the threat actor’s ETH crypto address inside: 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3

It uses the “node -i” command to run everything inside the memory, indicating fileless execution which avoids detection.

The malware builds and resolves multiple IP addresses which are used as a C2 server.

We found the following IP addresses being used by the malware –  103[.]179[.]143[.]219, 166[.]88[.]134[.]75, 23[.]27[.]13[.]72, 95[.]135[.]181[.]151

After downloading the remote payload from the server, the malware executes it using the same node -i command described above.

Affected Packages

Conclusion

PolinRider’s return comes just a week after the reported Binance hack, underscoring the relentless targeting of cryptocurrency and software supply chains. Even major cryptocurrency thefts have not brought an end to these campaigns.

With approximately 1,400 combined weekly downloads across the affected packages, this campaign highlights the continued risks of npm account hijacking.

Attackers don’t need to create malicious packages from scratch when they can hijack legitimate ones. Despite years of efforts to secure npm accounts and packages, the registry remains a valuable target for threat actors.

IOCs

  • 103[.]179[.]143[.]219
  • 166[.]88[.]134[.]75
  • 23[.]27[.]13[.]72
  • 95[.]135[.]181[.]151